WalletGenerator.net and the mystery of the backdoored random number generator.

Share this story

A website that bills itself as providing a safer way to store Bitcoin and other digital currencies has been using a coding sleight of hand to generate private keys that are suspiciously trivial for the operators to guess, leaving all funds stored in the wallets open to theft, researchers with a different service said on Friday.

WalletGenerator.net provides code for creating what are known as paper wallets for 197 different cryptocurrencies. Paper wallets were once billed as a secure way to store digital coins because—in theory, at least—the private keys that unlock the wallets are stored on paper, rather than on an Internet-connected device that can be hacked. (In reality, paper wallets are open to hack for a variety of reasons.) While the site advises people to download the code from this Github page and run it while the computer is unplugged from the Internet, it also hosted a simpler, stand-alone service above all the instructions for generating the same wallets.

Researchers from MyCrypto, which provides an open-source tool for cryptocurrency and blockchain users, compared the code hosted on Github and WalletGenerator.net and found some striking differences. Sometime between August 17 and August 25 of last year, the WalletGenerator.net code was changed to alter the way it produced the random numbers that are crucial for private keys to be secure.

Previously, mouse movements or key presses provided by the site visitor provided the random input needed to ensure the numbers weren’t predictable. The changed code introduced last August still allowed end users to see the text that prompted them to move their mouse or type characters, and it still showed a progress bar and graphics that responded in real time as the visitors complied. But behind the scenes, the MyCrypto researchers said, the code completely ignored this input.

Instead the WalletGenerator.net code used images supplied by the site to provide the random input. These changes resulted from the addition of a function called SecureRandomAdvanced, which modified the SecureRandom function previously used.

The code hosted on WalletGenerator.net was reverted back to its previous version sometime on Thursday, after the MyCrypto researchers reported the behavior to the site operator. As mentioned above, visitors who followed the advice to use the code hosted on Github—and not the code hosted on WalletGenerator.net—were never affected.

“In this strange turn of events, we still have no idea whether the current site owner is the malicious party, if the server is insecure, or both,” Harry Denley, MyCrypto’s director of security, wrote in a post published Friday. “We’re still considering this highly suspect and still recommending users who generated public/private keypairs after August 17, 2018 to move their funds. We do not recommend using WalletGenerator.net moving forward, even if the code at this very moment is not vulnerable.”

Unearthing a backdoor

One of the first differences MyCrypto researchers noticed in the changed code was that it requested an image be downloaded from the site. This request struck the researchers as odd, because the image had already loaded when their browser first visited the page. After more digging, they discovered that the newly added SecureRandomAdvanced function tapped data inside the image for the random input that previously came from mouse movements or inputted characters.

The researchers discovered some unusual characteristics to the image. For one, it was large. Stranger yet, while it appeared to be visually identical each time, different instances produced different cryptographic fingerprints known as checksums. These different sha256sums seemed to vary depending on the IP address of the computer that downloaded the image. Below are the checksums for the same file, named bitcoin.png, along with the file size and the IP location that received it:

The second and third entries, with the checksum beginning 479, correspond to the unmodified image. The other three were somehow modified. The researchers used a tool called binwalk to analyze the modified images, but they still aren’t sure what causes the the modified images to have different checksums even though they all appear visually identical. The researchers suspect the modified images contain hidden data that the SecureRandomAdvanced function used to generate the random numbers.

“We know something is happening to manipulate the image, but are unable to determine what exactly is happening,” Denley wrote. “Most steganography tools include a password functionality, meaning successfully decrypting the ‘hidden’ data is impossible without knowing the password provided at the time of constructing the image.”

The researchers tested their hypothesis by using a bulk function to generate 1,000 keys. The code from Github provided 1,000 unique key pairs. The code hosted on WalletGenerator.net, however, produced only 120 unique key pairs. When the researchers refreshed their browser, changed the IP location used by their virtual private network, and used the WalletGenerator.net code to produce subsequent 1,000-keypair batches, they would once again get only 120 unique pairs, but each time, they were different from previous sessions. Here's a video of what it looked like

WalletGenerator RNG compromised 1k keys

The researchers also found that using an image with the same checksum at a later date generated precisely the same set of 120 key pairs as previously generated. With that, they had proof the key pairs were fully deterministic based on the image. But that still didn’t explain how or why 120 unique key pairs were generated each time. In an email, Denley wrote:

I am not too versed in cryptography, but the general gist is only 120 keypairs generated instead of 1,000. These 120 keypairs are deterministic depending on the modified coin icon you have (since the keys are derived from the injected bytes of that file).

There were other parts of the logic modified that weren't illustrated in the article that may better explain the math behind _why_ 120, but in short, the logic was modified with a random number between 0 and 119 to make it entirely predictable outcome (the attacker would need to seed the logic with the same bytes from the image and run it 120 times to get a key that a user _may_ have used).

If you run the logic with the same coin icon, you'd get the same address each time, which is why a random number between 0 and 119 was added so it gave the illusion of a non-deterministic keypair generation.

Attempts to reach WalletGenerator.net operators for comment on Twitter didn’t succeed. According to Friday’s post, the operators told MyCrypto, “They were unable to verify our claims and asking if we were perhaps on a phishing site.”

In the operators’ defense, the site instructs users in two separate places not to run the code hosted on the site and instead to download the unmodified code from Github. Anyone who followed those directions would be unaffected by the insecure service hosted on WalletGenerator.net. Additionally, there’s no evidence—at least so far—that the wallets have been used to steal anyone’s cryptocurrency.

Still, the findings in Friday’s post are a red flag, not just about WalletGenerator.net in particular but for all free services that offer supposedly safe tools for storing cryptocurrency. Keeping digital coins secure from hackers is a full-time job that requires skill and diligence. People should invest huge amounts of investment, and serve generous portions of skepticism, before settling on a wallet.

Promoted Comments

I think it's high time to admit that the entire crypto scene is a gigantic fail. Clearly the incentives to crack and steal vastly outweigh the ability to provide any actual security. People don't want their "currency" to suddenly vanish because tech-savvy thieves are clearly more skilled than those hawking services to the crypto owners.

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

I think it's high time to admit that the entire crypto scene is a gigantic fail. Clearly the incentives to crack and steal vastly outweigh the ability to provide any actual security. People don't want their "currency" to suddenly vanish because tech-savvy thieves are clearly more skilled than those hawking services to the crypto owners.

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

I think it's high time to admit that the entire crypto scene is a gigantic fail. Clearly the incentives to crack and steal vastly outweigh the ability to provide any actual security. People don't want their "currency" to suddenly vanish because tech-savvy thieves are clearly more skilled than those hawking services to the crypto owners.

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

I would never buy any bitcoin personally but I expect banks had the same issues, people robbing them, over the centuries. Oddly, I haven't heard of many (or any) bank robberies recently.

Crypto is stored in a form that makes it easy to steal from thousands of miles away.The crypto "banks" (exchanges) are often just some random website run by semi-anonymous groups and trusted for no good reason.If someone steals your cryptocoin, you have no recourse for its return.

In contrast:Physical cash must be stolen in person from the entity holding that cash, which adds risk, difficulty and potential loss of anonymity.Banks handling real currency are required to be registered with the authorities of their country of business.If someone steals your real currency from a proper bank, the funds are insured and you never actually lose them.

Gee, maybe there should be a few regulations about who is authorized to transfer funds. And some for fraud protection. Add in some insurance for depositors. Then...Now this system is too centralized and burdensome. Hey, I've got an idea for a really free currency.

I think it's high time to admit that the entire crypto scene is a gigantic fail. Clearly the incentives to crack and steal vastly outweigh the ability to provide any actual security. People don't want their "currency" to suddenly vanish because tech-savvy thieves are clearly more skilled than those hawking services to the crypto owners.

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

I don’t think your point is entirely fair or accurate. The whole crypto space is relatively very new, there are still a lot of things that haven’t been figured out yet (security, technology, regulation etc), and I expect things to improve over time once a lot these things get figured out, this may take time and a few fails. Heck the modern banking system didn’t happen overnight. We all know the mess that led up to the 2008 banking crisis. But after every banking crisis the system becomes even stronger.

Does it mean I believe cryptos are in course for “world domination”? I don’t know, I just think it needs a bit more time before we can judge its future viability.

I think it's high time to admit that the entire crypto scene is a gigantic fail. Clearly the incentives to crack and steal vastly outweigh the ability to provide any actual security. People don't want their "currency" to suddenly vanish because tech-savvy thieves are clearly more skilled than those hawking services to the crypto owners.

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

I agree, not even American Credit cards, that stayed magnetic for over a decade more than anyone else, were this unsafe.

Not even close. American credit cards, as horribly insecure as they are, are infinitely more secure than any cryptocurrency, as I have had proven to me multiple times after fraudulent transactions... that the credit card company reversed on demand. It's not an ideal situation that it happens in the first, place, but it demonstrates clearly that the "technical" issues are often far less important than, say, using a system that has institutional safeguards and recourse to deal with theft.

I think it's high time to admit that the entire crypto scene is a gigantic fail. Clearly the incentives to crack and steal vastly outweigh the ability to provide any actual security. People don't want their "currency" to suddenly vanish because tech-savvy thieves are clearly more skilled than those hawking services to the crypto owners.

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

I don’t think your point is entirely fair or accurate. The whole crypto space is relatively very new, there are still a lot of things that haven’t been figured out yet (security, technology, regulation etc), and I expect things to improve over time once a lot these things get figured out, this may take time and a few fails. Heck the modern banking system didn’t happen overnight. We all know the mess that led up to the 2008 banking crisis. But after every banking crisis the system becomes even stronger.

Does it mean I believe cryptos are in course for “world domination”? I don’t know, I just think it needs a bit more time before we can judge its future viability.

How much time do you need, exactly? Evangelists have been touting bitcoin for 10 years, it has gone through 3 or 4 boom-and-bust cycles, and spawned many competitors, which have tried all sorts of alternatives, each of which appear to be just as doomed.

It's been tried. Lots. And it has become clear that irreversible transactions involving anonymous parties is a stupid idea that is fixable only by removing important features, like, oh, say irreversibility and anonymity.

edit: not to mention energy wastefulness that at this point in history verges on a crime against humanity.

I think it's high time to admit that the entire crypto scene is a gigantic fail. Clearly the incentives to crack and steal vastly outweigh the ability to provide any actual security. People don't want their "currency" to suddenly vanish because tech-savvy thieves are clearly more skilled than those hawking services to the crypto owners.

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

I don’t think your point is entirely fair or accurate. The whole crypto space is relatively very new, there are still a lot of things that haven’t been figured out yet (security, technology, regulation etc), and I expect things to improve over time once a lot these things get figured out, this may take time and a few fails. Heck the modern banking system didn’t happen overnight. We all know the mess that led up to the 2008 banking crisis. But after every banking crisis the system becomes even stronger.

Does it mean I believe cryptos are in course for “world domination”? I don’t know, I just think it needs a bit more time before we can judge its future viability.

Bitcoin et al fulfill (or attempted to fulfill) a societal need for an anonymous means of payment that can replace cash on the Internet scale.

As we are now learning, Bitcoin doesn't work for that purpose - not because of fraud, but because of the massive, and constantly growing, amount of data involved. Cryptocurrencies inherently have that problem.

But somebody else will come up with another new mechanism, and eventually hit upon something that does work.

I think it's high time to admit that the entire crypto scene is a gigantic fail. Clearly the incentives to crack and steal vastly outweigh the ability to provide any actual security. People don't want their "currency" to suddenly vanish because tech-savvy thieves are clearly more skilled than those hawking services to the crypto owners.

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

I don’t think your point is entirely fair or accurate. The whole crypto space is relatively very new, there are still a lot of things that haven’t been figured out yet (security, technology, regulation etc), and I expect things to improve over time once a lot these things get figured out, this may take time and a few fails. Heck the modern banking system didn’t happen overnight. We all know the mess that led up to the 2008 banking crisis. But after every banking crisis the system becomes even stronger.

Does it mean I believe cryptos are in course for “world domination”? I don’t know, I just think it needs a bit more time before we can judge its future viability.

Bitcoin et al fulfill (or attempted to fulfill) a societal need for an anonymous means of payment that can replace cash on the Internet scale.

As we are now learning, Bitcoin doesn't work for that purpose - not because of fraud, but because of the massive, and constantly growing, amount of data involved. Cryptocurrencies inherently have that problem.

But somebody else will come up with another new mechanism, and eventually hit upon something that does work.

Roll back to your first sentence: do we really have that need? Most people seem to like that the lack of anonymity means they get fraud protection, and services like Amazon, Stripe, ApplePay for the web, etc. are making it super easy to implement payments on web sites and apps (Venmo, Google & Apple Pay, etc.) are widely used in person.

I’m not saying there aren’t areas for improvement but I’m skeptical that there’s something more than incrementally chipping away at the overhead costs and ease of use.

Excellent sleuthing to uncover this. I can see a suspicious user trying a few times to make sure the numbers were different. 120 makes the obvious solution slanderous to walletgenerator.net

One day there will be an honest use for crypto currency (replacing cash perhaps as many science fiction stories assume), but we arent there yet

While I agreed with your first paragraph, the second one is pure bullshit. We will NEVER be using cryptocurrency to replace cash simply because it doesn't lend itself to regulation and oversight.

The reason for that is that cryptocurrency has no value other than what the people who buy into it decide it is. Currency has value based on governments deciding what it is. While it seems to be the same thing, it's not. The former is much more volatile than the latter. The whole point to having "cash" is that it mostly maintains its value from moment to moment within any given system.

Financial crises aside (because those things do happen), cryptocurrency doesn't maintain its value in nearly as stable of a fashion. Moreover, there's no recourse for getting one's cryptocurrency back in the event of fraud or theft, while there is with the "cash" system.

Remember, too, that any "cash" system allows one to take paper and metal and use it to obtain things. In the event of a power outage, commerce can still be done. With crypto, it ain't gonna ever happen that way because there is no ready way to turn a virtual item into a real one.

Finally, the fact that if you "regulate" cryptocurrencies as you do with "cash", they literally lose all value to those who invest in them the most. The draw is the anonymity and it's used primarily to launder money. The other use is to manipulate the "market" with pump and dump tactics that are almost impossible to do with a cash-based system (at least not without the government's blessing, and they do it for different reasons than self enrichment).

So, I think you'd have done better by sticking to the first half of your comment. The second half indicated a woeful lack of understanding of the differences between crypto and credit cards.

In the operators’ defense, the site instructs users in two separate places not to run the code hosted on the site and instead to download the unmodified code from Github

"OK now, Fido; I'm going to leave the room for a minute with my dinner plate on the floor, with both a juicy steak and some broccoli. Whatever you do, don't eat the steak. I strongly recommend that you eat the broccoli. K?"

While the site advises people to download the code from this Github page and run it while the computer is unplugged from the Internet, it also hosted a simpler, stand-alone service above all the instructions for generating the same wallets.

Quote:

In the operators’ defense, the site instructs users in two separate places not to run the code hosted on the site and instead to download the unmodified code from Github.

They specifically say that for security, download the program and run it on a non-networked computer...but if you really feel like it, use the website version.

If they were really on the up-and-up, why did they even provide a website version then tell people not to use it? Bizarre.

I think it's high time to admit that the entire crypto scene is a gigantic fail. Clearly the incentives to crack and steal vastly outweigh the ability to provide any actual security. People don't want their "currency" to suddenly vanish because tech-savvy thieves are clearly more skilled than those hawking services to the crypto owners.

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

I don’t think your point is entirely fair or accurate. The whole crypto space is relatively very new, there are still a lot of things that haven’t been figured out yet (security, technology, regulation etc), and I expect things to improve over time once a lot these things get figured out, this may take time and a few fails. Heck the modern banking system didn’t happen overnight. We all know the mess that led up to the 2008 banking crisis. But after every banking crisis the system becomes even stronger.

Does it mean I believe cryptos are in course for “world domination”? I don’t know, I just think it needs a bit more time before we can judge its future viability.

Nonsense, my point is entirely fair and accurate. Crypto has been around since 2009, that's plenty of time to figure out the security. But instead we see widespread insecurity at pretty much every stage of the infrastructure. Attacks like this one are common and nobody is addressing it.

Which is ultimately the reason we need to stick a fork in it. Because of the distributed nature of crypto, nobody wants to be responsible for the infrastructure and without a central entity responsible for establishing basic security, nobody is going to do so. That costs money, and nobody wants to be the one holding the bag. Pretty much all the major players are just in it for a quick payday.

Edit: I'll also add that security is hard. Just look at technologies like wifi where secure communications are critical. They get hacked all the time. As do e-commerce sites. Digital is inherently difficult/impossible to secure. And since crypto is entirely digital, it's likely that it will never be secure. And without a central organization taking responsibility, the consequences of that insecurity will always fall on the owners of the crypto.

I think it's high time to admit that the entire crypto scene is a gigantic fail. Clearly the incentives to crack and steal vastly outweigh the ability to provide any actual security. People don't want their "currency" to suddenly vanish because tech-savvy thieves are clearly more skilled than those hawking services to the crypto owners.

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

I don’t think your point is entirely fair or accurate. The whole crypto space is relatively very new, there are still a lot of things that haven’t been figured out yet (security, technology, regulation etc), and I expect things to improve over time once a lot these things get figured out, this may take time and a few fails. Heck the modern banking system didn’t happen overnight. We all know the mess that led up to the 2008 banking crisis. But after every banking crisis the system becomes even stronger.

Does it mean I believe cryptos are in course for “world domination”? I don’t know, I just think it needs a bit more time before we can judge its future viability.

Bitcoin et al fulfill (or attempted to fulfill) a societal need for an anonymous means of payment that can replace cash on the Internet scale.

As we are now learning, Bitcoin doesn't work for that purpose - not because of fraud, but because of the massive, and constantly growing, amount of data involved. Cryptocurrencies inherently have that problem.

But somebody else will come up with another new mechanism, and eventually hit upon something that does work.

Roll back to your first sentence: do we really have that need?

Yes, of course. I'm flabbergasted that anybody would even question that. If you personally don't mind non-anonymous payments, that's fine. Forcing that on everybody else crosses a line.

And there are many reasons why we do need anonymous payments.

First of all, tracking all monetary transactions is seriously Soviet-Union style creepy.

Secondly, there are quite a few practical situations where anonymous payments are important. One current example is paying for weed in states where weed is legal but banks aren't an option.

Third, you don't even have to go back to the Soviet Union. Joe McCarthy would be delighted if he could have not just blacklisted people professionally, but prevented them from even buying groceries. I don't want to accuse Trump of doing the same (because there is zero evidence that so far he has) but even here in the USA, we far too frequently have politicians who do like to use this kind of approach.

But ultimately, it comes down to a very simple thing: even if I just buy a coffee at Starbucks, it's nobody's business.

I think it's high time to admit that the entire crypto scene is a gigantic fail. Clearly the incentives to crack and steal vastly outweigh the ability to provide any actual security. People don't want their "currency" to suddenly vanish because tech-savvy thieves are clearly more skilled than those hawking services to the crypto owners.

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

I don’t think your point is entirely fair or accurate. The whole crypto space is relatively very new, there are still a lot of things that haven’t been figured out yet (security, technology, regulation etc), and I expect things to improve over time once a lot these things get figured out, this may take time and a few fails. Heck the modern banking system didn’t happen overnight. We all know the mess that led up to the 2008 banking crisis. But after every banking crisis the system becomes even stronger.

Does it mean I believe cryptos are in course for “world domination”? I don’t know, I just think it needs a bit more time before we can judge its future viability.

Bitcoin et al fulfill (or attempted to fulfill) a societal need for an anonymous means of payment that can replace cash on the Internet scale.

As we are now learning, Bitcoin doesn't work for that purpose - not because of fraud, but because of the massive, and constantly growing, amount of data involved. Cryptocurrencies inherently have that problem.

But somebody else will come up with another new mechanism, and eventually hit upon something that does work.

Roll back to your first sentence: do we really have that need?

Yes, of course. I'm flabbergasted that anybody would even question that. If you personally don't mind non-anonymous payments, that's fine. Forcing that on everybody else crosses a line.

Cash provides anonymous payments. And I've never worried about malware stealing my cash when I use a wallet or billfold.

Cryptocurrency seems to be offering much less security, especially to non-experts, and that's not even considering the context of the present article.

Quote:

And there are many reasons why we do need anonymous payments.

First of all, tracking all monetary transactions is seriously Soviet-Union style creepy.

Do you trust your bank or not?

Quote:

Secondly, there are quite a few practical situations where anonymous payments are important. One current example is paying for weed in states where weed is legal but banks aren't an option.

Before weed was legalized to the extent it has been thus far, it generally functioned as a cash-only system.

At this point, a dispensary will take your credit card, fill up a store-specific gift card with the appropriate amount, and use the later to fulfill your purchase, at roughly a 3% transaction charge overhead.

Quote:

But ultimately, it comes down to a very simple thing: even if I just buy a coffee at Starbucks, it's nobody's business.

Sure...you can keep your coffee between you and your barista with cash easily enough.

I don't see how using cryptocurrency helps you stay unknown for this case. It would seem a lot more likely that mobile beacons and geo-fencing targeting that particular Starbucks would give data miners substantial ability to link your phone #/IMEI id, your identity from their mobile app, or almost anything else that might be visible if you use their WiFi without using a VPN.

I think it's high time to admit that the entire crypto scene is a gigantic fail. Clearly the incentives to crack and steal vastly outweigh the ability to provide any actual security. People don't want their "currency" to suddenly vanish because tech-savvy thieves are clearly more skilled than those hawking services to the crypto owners.

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

I don’t think your point is entirely fair or accurate. The whole crypto space is relatively very new, there are still a lot of things that haven’t been figured out yet (security, technology, regulation etc), and I expect things to improve over time once a lot these things get figured out, this may take time and a few fails. Heck the modern banking system didn’t happen overnight. We all know the mess that led up to the 2008 banking crisis. But after every banking crisis the system becomes even stronger.

Does it mean I believe cryptos are in course for “world domination”? I don’t know, I just think it needs a bit more time before we can judge its future viability.

Bitcoin et al fulfill (or attempted to fulfill) a societal need for an anonymous means of payment that can replace cash on the Internet scale.

As we are now learning, Bitcoin doesn't work for that purpose - not because of fraud, but because of the massive, and constantly growing, amount of data involved. Cryptocurrencies inherently have that problem.

But somebody else will come up with another new mechanism, and eventually hit upon something that does work.

Roll back to your first sentence: do we really have that need?

Yes, of course. I'm flabbergasted that anybody would even question that. If you personally don't mind non-anonymous payments, that's fine. Forcing that on everybody else crosses a line.

Cash provides anonymous payments. And I've never worried about malware stealing my cash when I use a wallet or billfold.

Exactly. But cash is only good for in-person transactions. That's why there is a need for some electronic anonymous money. That was the original promise of bitcoin, but it didn't work.

And you are absolutely correct that today's cryptocurrencies have major problems and aren't suitable as cash replacement. That was my point.

Quote:

Quote:

And there are many reasons why we do need anonymous payments.

First of all, tracking all monetary transactions is seriously Soviet-Union style creepy.

Do you trust your bank or not?

Trust with what? That they won't lose my money? Yes, for the most part.

But you are asking the wrong question. It's not about "trust" at all. It's about that it's not Wells Fargo's or Visa's business (or whomever they sell the data to) how often I go to Starbucks. Just as it isn't Facebook's or Google's, or for that matter the NSA's or the FSB's.

Quote:

Quote:

Secondly, there are quite a few practical situations where anonymous payments are important. One current example is paying for weed in states where weed is legal but banks aren't an option.

Before weed was legalized to the extent it has been thus far, it generally functioned as a cash-only system.

At this point, a dispensary will take your credit card, fill up a store-specific gift card with the appropriate amount, and use the later to fulfill your purchase, at roughly a 3% transaction charge overhead.

That's interesting; I'm not sure how they are getting credit card processors to agree; it doesn't seem to be universal. California seems to be struggling with most dispensaries being cash-only businesses for lack of access to banks.

And in any case, if I used weed, I would most certainly *not* want Bank of America to know that I bought weed. Again, it's none of their business.

Quote:

Quote:

But ultimately, it comes down to a very simple thing: even if I just buy a coffee at Starbucks, it's nobody's business.

Sure...you can keep your coffee between you and your barista with cash easily enough.

Excellent sleuthing to uncover this. I can see a suspicious user trying a few times to make sure the numbers were different. 120 makes the obvious solution slanderous to walletgenerator.net

One day there will be an honest use for crypto currency (replacing cash perhaps as many science fiction stories assume), but we arent there yet

While I agreed with your first paragraph, the second one is pure bullshit. We will NEVER be using cryptocurrency to replace cash simply because it doesn't lend itself to regulation and oversight.

The reason for that is that cryptocurrency has no value other than what the people who buy into it decide it is. Currency has value based on governments deciding what it is. While it seems to be the same thing, it's not. The former is much more volatile than the latter. The whole point to having "cash" is that it mostly maintains its value from moment to moment within any given system.

Financial crises aside (because those things do happen), cryptocurrency doesn't maintain its value in nearly as stable of a fashion. Moreover, there's no recourse for getting one's cryptocurrency back in the event of fraud or theft, while there is with the "cash" system.

Remember, too, that any "cash" system allows one to take paper and metal and use it to obtain things. In the event of a power outage, commerce can still be done. With crypto, it ain't gonna ever happen that way because there is no ready way to turn a virtual item into a real one.

Finally, the fact that if you "regulate" cryptocurrencies as you do with "cash", they literally lose all value to those who invest in them the most. The draw is the anonymity and it's used primarily to launder money. The other use is to manipulate the "market" with pump and dump tactics that are almost impossible to do with a cash-based system (at least not without the government's blessing, and they do it for different reasons than self enrichment).

So, I think you'd have done better by sticking to the first half of your comment. The second half indicated a woeful lack of understanding of the differences between crypto and credit cards.

Not many actual facts here, just assertions. So here's a few of mine:1) Turkey is the only country in the world using a gold standard (and its not working well for them). All other currencies are fiat/trust based.2) There is no technical reason why a cryptocurrency cannot be backed by a country/bank/commercial entity.3) There is no technical reason why cryptocurrencies must be open to investors. Your specific assertion about pump/dump and speculation is a question of scale, and the majority shareholder's interest in stability.4) There is no technical reason why a cryptocurrency wallet must be online / global. NFC based and hardware locked is doable with current technology - the ledger just gets delayed.4) Good luck getting stolen/lost cash back, unless you've scanned all the serial numbers and can prove ownership (i.e. you are a casino or bank).

Yes, of course. I'm flabbergasted that anybody would even question that. If you personally don't mind non-anonymous payments, that's fine. Forcing that on everybody else crosses a line.

Cash provides anonymous payments. And I've never worried about malware stealing my cash when I use a wallet or billfold.

Exactly. But cash is only good for in-person transactions. That's why there is a need for some electronic anonymous money. That was the original promise of bitcoin, but it didn't work.

And you are absolutely correct that today's cryptocurrencies have major problems and aren't suitable as cash replacement. That was my point.

Cash works best for in-person transactions, but people have mailed cash or checks/etc and gotten stuff shipped back as well.

Sure, I can see some appeal for "electronic anonymous money" instead.

Quote:

Quote:

Quote:

And there are many reasons why we do need anonymous payments.

First of all, tracking all monetary transactions is seriously Soviet-Union style creepy.

Do you trust your bank or not?

Trust with what? That they won't lose my money? Yes, for the most part.

But you are asking the wrong question. It's not about "trust" at all. It's about that it's not Wells Fargo's or Visa's business (or whomever they sell the data to) how often I go to Starbucks. Just as it isn't Facebook's or Google's, or for that matter the NSA's or the FSB's.

I meant whether you trusted your bank with your transaction history-- that you made a purchase at Starbucks per your example. (Hopefully, one can rely on the FDIC to protect your account for a real bank.)

With regard to sharing transactions, my bank says "We will not share information we collect about you with nonaffiliated third parties, except as permitted by California law, such as to process your transactions or to maintain your account."

The anti-crypto sentiment on Ars has always befuddled me. I understand the incredulity but why is the sentiment so strong that one would feel the need to repeatedly make the same inane, banal statements decrying something? If the idea of cryptocurrency—or anything really—bothers you, then don’t use it! It’s not like you’re adding some new insight, or that your sharing conclusions arrived at after spending considerable time and energy studying the matter in depth. You're literally just rehashing the same talking points that have been made over and over again, ad nauseum.

For the record, I own no cryptocurrency, though I have had probably a few hundred dollars worth in total pass through my hands over the span of a few years. I personally never found it to be particularly useful. It sucks for pretty much any transaction I might make in my day to day; as an investment, it’s about as good as putting your money into the slot machines. Just because I don’t have any interest in it or use case where it is superior to other methods doesn’t mean that holds true for everyone. I don’t endorse it, I don’t malign it, I just ignore it. I certainly don’t feel the need to critique it by offering the same cliched, superficial reasoning that is so completely non illuminating. The same way I don’t need to constantly tell people why being stuck in traffic sucks or that smoking cigarettes can be bad for your health.

So why did you read the comment section of an article about insecure crypto-wallets? Did you expect to see no critique or criticism of crypto security?

This is like reading an article on research into the link between smoking and lung cancer, or related dangers to such, and expecting no one to comment on the link between smoking and lung cancer. It's literally what the article is about.

I agree the crypto money scene is doomed but for a different reason. What are the primary advantages of crypto money? Yes, for a few people it's crypto-anarchy related political reasons but for most people who actually use the currency (not merely speculate...which can't in the long term maintain the value) it's the following:

1) Universability. You don't need to have a relation with paypal or some other payment processor (who might for political or legal reasons not operate in your area or for your type of transaction).

2) Impossibility of charge backs. Once the money is in your account it's there. No credit card company can reverse the charges. If you need to recover money after a transaction you need to sue.

But these benefits could easily be offered by companies creating their own digital payment systems with very loose rules on who can get an account under any government who was willing to remain largely hands off. This is something attractive to some governments since they could still retain the ability to block terrorist financing (as long as this didn't make it difficult for the vast majority to open an account even without official ID) as well as the opportunity to profit. When the alternative is people using true cryptocurrencies I suspect we will soon see true versions of government tolerated digital cash that doesn't have any of the overhead of bitcoin mining.

I think it's high time to admit that the entire crypto scene is a gigantic fail. Clearly the incentives to crack and steal vastly outweigh the ability to provide any actual security. People don't want their "currency" to suddenly vanish because tech-savvy thieves are clearly more skilled than those hawking services to the crypto owners.

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

I don’t think your point is entirely fair or accurate. The whole crypto space is relatively very new, there are still a lot of things that haven’t been figured out yet (security, technology, regulation etc), and I expect things to improve over time once a lot these things get figured out, this may take time and a few fails. Heck the modern banking system didn’t happen overnight. We all know the mess that led up to the 2008 banking crisis. But after every banking crisis the system becomes even stronger.

Does it mean I believe cryptos are in course for “world domination”? I don’t know, I just think it needs a bit more time before we can judge its future viability.

Bitcoin et al fulfill (or attempted to fulfill) a societal need for an anonymous means of payment that can replace cash on the Internet scale.

As we are now learning, Bitcoin doesn't work for that purpose - not because of fraud, but because of the massive, and constantly growing, amount of data involved. Cryptocurrencies inherently have that problem.

But somebody else will come up with another new mechanism, and eventually hit upon something that does work.

Roll back to your first sentence: do we really have that need?

Yes, of course. I'm flabbergasted that anybody would even question that. If you personally don't mind non-anonymous payments, that's fine. Forcing that on everybody else crosses a line.

And there are many reasons why we do need anonymous payments.

First of all, tracking all monetary transactions is seriously Soviet-Union style creepy.

Secondly, there are quite a few practical situations where anonymous payments are important. One current example is paying for weed in states where weed is legal but banks aren't an option.

I’m not saying I love the status quo, but changing financial systems is hard and I don’t think that the number of people who want to buy weed online and trust that they’re not buying from the DEA is large enough to bootstrap a mainstream cash replacement. If that’s the area where it’s better, it’d be risky just to use it since that’d be a good signal that you were doing something you didn’t want observed.

That brings me to the second problem: if you want privacy from a state-level actor, why on earth would you gift wrap your entire history for them in a conveniently hard to repudiate format like Bitcoin? It’d be much safer to use cash or even just to claim that your card was stolen.

(Also, the McCarthy stuff has similar problems: if things get that bad, not being to buy weed will pale before not getting a paycheck or being able to pay your utilities. The solution for that is strong anti-authoritarian institutions, not technology)

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

For the same reason that tor is only useful to criminals and yet still desirable, I actually do want criminals to have their own currency. Criminals are both people doing genuinely undesirable things and people doing things they have every right to do but which happen to be illegal in whatever jurisdiction they reside in. If there were some technology enabling people to break bad laws without also enabling people to do genuinely bad things I'd applaud it. Until then I'll keep hoping that crypto-currency works in the long term.

I think it's high time to admit that the entire crypto scene is a gigantic fail. Clearly the incentives to crack and steal vastly outweigh the ability to provide any actual security. People don't want their "currency" to suddenly vanish because tech-savvy thieves are clearly more skilled than those hawking services to the crypto owners.

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

I don’t think your point is entirely fair or accurate. The whole crypto space is relatively very new, there are still a lot of things that haven’t been figured out yet (security, technology, regulation etc), and I expect things to improve over time once a lot these things get figured out, this may take time and a few fails. Heck the modern banking system didn’t happen overnight. We all know the mess that led up to the 2008 banking crisis. But after every banking crisis the system becomes even stronger.

Does it mean I believe cryptos are in course for “world domination”? I don’t know, I just think it needs a bit more time before we can judge its future viability.

Bitcoin et al fulfill (or attempted to fulfill) a societal need for an anonymous means of payment that can replace cash on the Internet scale.

As we are now learning, Bitcoin doesn't work for that purpose - not because of fraud, but because of the massive, and constantly growing, amount of data involved. Cryptocurrencies inherently have that problem.

But somebody else will come up with another new mechanism, and eventually hit upon something that does work.

Roll back to your first sentence: do we really have that need?

Yes, of course. I'm flabbergasted that anybody would even question that. If you personally don't mind non-anonymous payments, that's fine. Forcing that on everybody else crosses a line.

And there are many reasons why we do need anonymous payments.

First of all, tracking all monetary transactions is seriously Soviet-Union style creepy.

Secondly, there are quite a few practical situations where anonymous payments are important. One current example is paying for weed in states where weed is legal but banks aren't an option.

I’m not saying I love the status quo, but changing financial systems is hard and I don’t think that the number of people who want to buy weed online and trust that they’re not buying from the DEA is large enough to bootstrap a mainstream cash replacement. If that’s the area where it’s better, it’d be risky just to use it since that’d be a good signal that you were doing something you didn’t want observed.

That's one of the reasons such a cash replacement would have to be widely used.

Quote:

That brings me to the second problem: if you want privacy from a state-level actor, why on earth would you gift wrap your entire history for them in a conveniently hard to repudiate format like Bitcoin? It’d be much safer to use cash or even just to claim that your card was stolen.

That's actually one of quite a few reasons I said that Bitcoin is utterly unsuitable as cash replacement. I'm saying that there is a need for an anonymous payment mechanism. I'm not saying that Bitcoin (or anything blockchain based) is it.

That said - theoretically, in the original vision, it would actually not be easy to tie bitcoin transactions back to a person. What makes bitcoin easy to trace is that most people use intermediaries. Also, the original vision included that you'd frequently throw away the wallet and create a new one. But that turned out to be impractical because of the amount of data involved.

Quote:

(Also, the McCarthy stuff has similar problems: if things get that bad, not being to buy weed will pale before not getting a paycheck or being able to pay your utilities. The solution for that is strong anti-authoritarian institutions, not technology)

I agree with your sentiment, not with the conclusion. We need both: anti-authoritarian institutions (and a culture of anti-authoritarianism), as well as technology (and other structures) that is makes abuse as hard as possible. The main problem is that anti-authoritarian institutions are easily undermined, and you don't want to already have a turnkey surveillance system in place when - not if - that happens.

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

For the same reason that tor is only useful to criminals and yet still desirable, I actually do want criminals to have their own currency. Criminals are both people doing genuinely undesirable things and people doing things they have every right to do but which happen to be illegal in whatever jurisdiction they reside in. If there were some technology enabling people to break bad laws without also enabling people to do genuinely bad things I'd applaud it. Until then I'll keep hoping that crypto-currency works in the long term.

Interesting, and very apropos, that you mention Tor in this context. Tor was actually created by the US Navy, specifically to allow US agents to communicate back to the USA. As far as I know, the Navy still provides much of the funding for the project.

It's also frequently used for legitimate purposes - the criminal ones are just more visible.

I think it's high time to admit that the entire crypto scene is a gigantic fail. Clearly the incentives to crack and steal vastly outweigh the ability to provide any actual security. People don't want their "currency" to suddenly vanish because tech-savvy thieves are clearly more skilled than those hawking services to the crypto owners.

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

I don’t think your point is entirely fair or accurate. The whole crypto space is relatively very new, there are still a lot of things that haven’t been figured out yet (security, technology, regulation etc), and I expect things to improve over time once a lot these things get figured out, this may take time and a few fails. Heck the modern banking system didn’t happen overnight. We all know the mess that led up to the 2008 banking crisis. But after every banking crisis the system becomes even stronger.

Does it mean I believe cryptos are in course for “world domination”? I don’t know, I just think it needs a bit more time before we can judge its future viability.

The very things crypto prides itself in not being or doing are the things that make banking safe. Irreversible transactions are bad, because it makes it virtually impossible to respond to theft in any meaningful way.

You know what you get when you fix the problems with cryptocurrency? Traditional currency and banking. Maybe the people who have been doing this since the dawn of civilization found effective solutions to those problems, refined them over time, and that's what shaped the institutions into what you see today?

Nah, that's way too obvious. Back to reinventing the wheel! We're smarter than everyone!

I think it's high time to admit that the entire crypto scene is a gigantic fail. Clearly the incentives to crack and steal vastly outweigh the ability to provide any actual security. People don't want their "currency" to suddenly vanish because tech-savvy thieves are clearly more skilled than those hawking services to the crypto owners.

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

Anytime there is something of value where there is an incentive to take it someone will find a way to take it especially if it can be done anonymously. Crypto currencies are overall very vulnerable but they are most vulnerable at their weakest point which is, for the majority, the on line 'storage locations' for their wallets.

I think it's high time to admit that the entire crypto scene is a gigantic fail. Clearly the incentives to crack and steal vastly outweigh the ability to provide any actual security. People don't want their "currency" to suddenly vanish because tech-savvy thieves are clearly more skilled than those hawking services to the crypto owners.

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

I don’t think your point is entirely fair or accurate. The whole crypto space is relatively very new, there are still a lot of things that haven’t been figured out yet (security, technology, regulation etc), and I expect things to improve over time once a lot these things get figured out, this may take time and a few fails. Heck the modern banking system didn’t happen overnight. We all know the mess that led up to the 2008 banking crisis. But after every banking crisis the system becomes even stronger.

Does it mean I believe cryptos are in course for “world domination”? I don’t know, I just think it needs a bit more time before we can judge its future viability.

This is a general problem of every system that actually protects the users privacy and data properly (or at least attempts to like crypto currencies) because the only way to do that is to transfer responsibility on to the user.

We can see just how lazy majority are already on IM chats where vanishingly small number of people actually bother with securing their communication by checking the actual crypto keys used when the app actually allows it (Threema, signal, few others). Hell, even people who should know better claim that apples ichat is secure when it is apple that handles all the keys and user has no means of verifying or even finding out what keys are used.

Essentially humans are lazy bums who don't value anything other than laziness and being manipulated like a bunch of sheep that we are.

I think it's high time to admit that the entire crypto scene is a gigantic fail. Clearly the incentives to crack and steal vastly outweigh the ability to provide any actual security. People don't want their "currency" to suddenly vanish because tech-savvy thieves are clearly more skilled than those hawking services to the crypto owners.

It was a mildly interesting thought experiment and it has conclusively proven that crypto isn't even remotely useful as a store of value. Except to criminals, and I'm not sure we really want them to have their own "currency".

I don’t think your point is entirely fair or accurate. The whole crypto space is relatively very new, there are still a lot of things that haven’t been figured out yet (security, technology, regulation etc), and I expect things to improve over time once a lot these things get figured out, this may take time and a few fails. Heck the modern banking system didn’t happen overnight. We all know the mess that led up to the 2008 banking crisis. But after every banking crisis the system becomes even stronger.

Does it mean I believe cryptos are in course for “world domination”? I don’t know, I just think it needs a bit more time before we can judge its future viability.

The very things crypto prides itself in not being or doing are the things that make banking safe. Irreversible transactions are bad, because it makes it virtually impossible to respond to theft in any meaningful way.

You know what you get when you fix the problems with cryptocurrency? Traditional currency and banking. Maybe the people who have been doing this since the dawn of civilization found effective solutions to those problems, refined them over time, and that's what shaped the institutions into what you see today?

Nah, that's way too obvious. Back to reinventing the wheel! We're smarter than everyone!

Banking has advantages - and you are naming a few here. It also has drawbacks.

Cash (and electronic equivalents) has advantages. And it has drawbacks. Including being irreversible.

Where you are going wrong is drawing the conclusion that "banking is good, cash is bad". They are both needed and both have their place.